Ransomware Detection via File Operation Pattern Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods are ineffective in preventing file encryption attacks by ransomware, as they often fail to detect unknown malware in time, leading to incomplete prevention of file encryption and damage.
Innovation Solution
A program that functions as a judging unit to identify ransomware by monitoring file read and write functions, specifically looking for patterns such as file path consistency, header rewriting, and file movement, to determine if a process is ransomware and prevent further encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security software uses pattern file detection, then known malware can be detected, but unknown ransomware cannot be detected in time
Solution Approach 1:
The patent monitors file operation patterns in advance and establishes baseline behavior characteristics before ransomware encryption occurs. By tracking read/write operations, file path changes, and header modifications proactively, the system can detect anomalies immediately when they deviate from normal patterns, enabling timely prevention of unknown ransomware attacks.
Solution Approach 2:
The system continuously monitors actual file operation behavior and compares it against established patterns, providing real-time feedback when anomalies are detected. This feedback mechanism enables dynamic adjustment of detection thresholds and triggers immediate response actions when ransomware behavior patterns are identified, regardless of whether the specific malware is known.
2Productivity
If the terminal is turned off immediately upon early detection, then some file encryption is prevented, but complete damage prevention is difficult
Solution Approach 1:
Instead of immediately shutting down the terminal, the patent introduces an intermediary intervention mechanism that blocks specific malicious file operations while allowing the system to remain operational. This mediator approach enables selective prevention of encryption operations based on detected ransomware behavior patterns, achieving both speed and completeness in damage prevention.
Solution Approach 2:
The system takes preliminary anti-action by blocking ransomware encryption operations before they can complete, based on detected behavioral patterns. By preventing the encryption process itself rather than reacting after encryption occurs, the system achieves complete damage prevention while maintaining system productivity through targeted intervention.
3Speed
If file encryption is started immediately upon infection, then ransomware executes quickly, but normal detection cannot be made in time
Solution Approach 1:
The patent maintains continuous monitoring of file operation patterns from the moment of infection, ensuring that detection actions occur simultaneously with ransomware execution rather than afterward. This continuous observation enables accurate detection of encryption behavior patterns in real-time, matching the speed of ransomware execution while maintaining detection precision.
Data Source
AI summary
The present invention provides a program, an information processing apparatus, and an information processing method which can effectively prevent malware attacks. A predetermined process is judged as a ransomware, when a first condition that a file read function for reading a file included in a same file path as a file path written by a file write function called from the predetermined process has been already called from the predetermined process; and a second condition that the file write function rewrites a header of a file of the file path: are satisfied. A predetermined process is judged as a ransomware, when a first condition that an actual file on a disk is mapped as a virtual file on a memory by the predetermined process; a second condition that the virtual file is unmapped by the predetermined process; and a third condition that a file structure of the actual file or the virtual file when unmapping is rewritten to inappropriate status: are satisfied.